From mboxrd@z Thu Jan 1 00:00:00 1970 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on inbox.vuxu.org X-Spam-Level: X-Spam-Status: No, score=-1.1 required=5.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,MAILING_LIST_MULTI,RCVD_IN_MSPIKE_H2 autolearn=ham autolearn_force=no version=3.4.4 Received: (qmail 4502 invoked from network); 5 Nov 2022 12:30:43 -0000 Received: from second.openwall.net (193.110.157.125) by inbox.vuxu.org with ESMTPUTF8; 5 Nov 2022 12:30:43 -0000 Received: (qmail 19873 invoked by uid 550); 5 Nov 2022 12:30:40 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Reply-To: musl@lists.openwall.com Received: (qmail 19841 invoked from network); 5 Nov 2022 12:30:39 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=inria.fr; s=dc; h=date:from:to:cc:subject:message-id:in-reply-to: references:mime-version; bh=ztguuo2H3M5eZhoylTf9mGe2TEtO+reRNeJ+KIFF5kA=; b=jc8AxTHpD/p+BPZbCioJ+9kmtc3DU0ODhFvVCvV9emd63b3RncNF5ODT NHzaQWC2kOLAJfPEZDpn7LXwU/zkzKD+VDoHIhvL481qvQMZtg4wNY/j3 fOtFHeA2fpJWtHNN2dwLlZFGx3QbhWLZ/2mfxkZr5IlXAw8yHdDsks2h1 U=; Authentication-Results: mail2-relais-roc.national.inria.fr; dkim=none (message not signed) header.i=none; spf=SoftFail smtp.mailfrom=jens.gustedt@inria.fr; dmarc=fail (p=none dis=none) d=inria.fr X-IronPort-AV: E=Sophos;i="5.96,140,1665439200"; d="scan'208";a="75176643" Date: Sat, 5 Nov 2022 13:30:25 +0100 From: =?UTF-8?B?SuKCkeKCmeKCmw==?= Gustedt To: "Alex Xu (Hello71)" Cc: musl@lists.openwall.com, Szabolcs Nagy , Markus Wichmann Message-ID: <20221105133025.36fa0d05@inria.fr> In-Reply-To: <1667648794.ymyp54wny2.none@localhost> References: <20221103194216.GA7714@voyager> <20221105100936.GC98588@port70.net> <1667648794.ymyp54wny2.none@localhost> Organization: inria.fr X-Mailer: Claws Mail 4.0.0 (GTK+ 3.24.33; x86_64-pc-linux-gnu) X-Face: iVBORw0KGgoAAAANSUhEUgAAADAAAAAwBAMAAAClLOS0AAAAAXNSR0IArs4c6QAAACRQTFRFERslNjAsLTE9Ok9wUk9TaUs8iWhSrYZkj42Rz6aD3sGZ MIME-Version: 1.0 Content-Type: multipart/signed; boundary="Sig_/0niwPk7lAyzBsjLoFWHlXH."; protocol="application/pgp-signature"; micalg=pgp-sha1 Subject: Re: [musl] Invalid read of nl_arg in printf_core() --Sig_/0niwPk7lAyzBsjLoFWHlXH. Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Alex, on Sat, 05 Nov 2022 07:52:09 -0400 you ("Alex Xu (Hello71)" ) wrote: > Excerpts from Szabolcs Nagy's message of November 5, 2022 6:09 am: > > * Markus Wichmann [2022-11-03 20:42:16 +0100]: =20 > >> Hi all, > >>=20 > >> reading some code today, I noticed undefined behavior in > >> printf_core(). vfprintf() creates an array called nl_arg > >> automatically and does not initialize it. That is fine, but it > >> means that reads from each array member are undefined behavior > >> until that member gets assigned a value. =20 > >=20 > > an automatic storage object that was not initialized has > > indeterminate value, so accessing it is not undefined behaviour. > > (unless the object could have been declared with the register > > storage class) > >=20 > > so technically the code is correct (if int has no trap > > representations) but i think the fix still makes sense: leaving > > unspecified values around is error prone. =20 >=20 > N1570 J.2 [Undefined behavior]: >=20 > 1 The behavior is undefined in the following circumstances: > [ ... ] > =E2=80=94 The value of an object with automatic storage duration is used > while it is indeterminate (6.2.4, 6.7.9, 6.8). N1570 is old and annex J is only informative. The version for C23 reads The value of an object with automatic storage duration is used while the object has an indeterminate representation (6.2.4, 6.7.10, 6.8). which is already a bit more subtle. Observe that it says "use" and does not say that it is undefined to do the lvalue (object representation -> value) conversion. There have been multiple interpretations and endless discussions over the years of this kind of question and no unique conclusion about its "official" status w.r.t to the standard has been acknowledged. But the inofficial status of this is that it is "bad" and reading uninitialized values should be avoided. This holds in particular where the possible gain by optimization (speed or code size) is marginal, so the gain versus risk balance is not very favorable. Thanks J=E2=82=91=E2=82=99=E2=82=9B --=20 :: INRIA Nancy Grand Est ::: Camus ::::::: ICube/ICPS ::: :: :::::::::::::::::::::: gsm France : +33 651400183 :: :: ::::::::::::::: gsm international : +49 15737185122 :: :: http://icube-icps.unistra.fr/index.php/Jens_Gustedt :: --Sig_/0niwPk7lAyzBsjLoFWHlXH. Content-Type: application/pgp-signature Content-Description: OpenPGP digital signature -----BEGIN PGP SIGNATURE----- iF0EARECAB0WIQSN9stI2OFN1pLljN0P0+hp2tU34gUCY2ZXYQAKCRAP0+hp2tU3 4qOoAJkBJyZwvj4nxNzLlaYt1mh0MURO5QCeMocs1BrjS+swWHebmhAGNjqABYg= =VsfN -----END PGP SIGNATURE----- --Sig_/0niwPk7lAyzBsjLoFWHlXH.--